[RESOLVED] I thought it was my site, but it might be my computer

**Cassel** · June 28th, 2015, 08:46 PM

I posted in another thread, thinking i had encountered issues with my site as for a few times, navigating on the site would redirect me to some other pages, totally unrelated. It only happened on my site, although nobody reported that behavior. As i had issues with my host and my site, i suspected it was the cause, but after a few scans of my computer, Train suggested i come here (again!).

Here is my first scan log of Farbar (part of it):
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:28-06-2015 01
Ran by User (administrator) on CAROLEDESKTOP on 28-06-2015 21:41:04
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available Profiles: User & UpdatusUser & Carole)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic...ery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Don HO don.h@free.fr) C:\Program Files (x86)\Notepad++\notepad++.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Sococo) C:\Program Files (x86)\Sococo\HUD\Sococo.exe
() C:\Program Files (x86)\Sococo\HUD\SococoBrowser.exe
(Social Communications Company) C:\Program Files (x86)\Sococo\HUD\HudDog.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(CybelSoft) C:\Program Files\ma-config.com\MaConfigAgent.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\WTabletServiceCon.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Pen\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
(Jasc Software, Inc.) C:\Program Files (x86)\Jasc Software Inc\Paint Shop Pro 9\Paint Shop Pro 9.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Corel, Inc.) C:\Program Files\Corel\Corel PaintShop Pro X6 (64-bit)\Corel PaintShop Pro.exe
(arvato digital services llc) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Corel, Inc.) C:\Program Files\Corel\Corel PaintShop Pro X7 (64-bit)\Corel PaintShop Pro.exe
(Microsoft Corporation) C:\Windows\System32\prevhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\prevhost.exe
() E:\Carole\PSP\utilitaires\FileZilla_2_2_32\FileZilla.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\User\AppData\Roaming\AnyMeeting\anymeeting.exe
() C:\Users\User\AppData\Roaming\AnyMeeting\anymeeting.exe
() C:\Users\User\AppData\Roaming\AnyMeeting\anymeeting.exe
(TechSmith Corporation) C:\Program Files (x86)\TechSmith\Camtasia Studio 8\CamtasiaStudio.exe
(TechSmith Corporation) C:\Program Files (x86)\TechSmith\Camtasia Studio 8\TscHelp.exe
(WinZip Computing, S.L.) C:\Program Files\WinZip\WzPreviewer64.exe
(FSL) C:\Program Files (x86)\FSL\SuperFinder\SuperFinder.exe
() C:\Users\User\AppData\Roaming\AnyMeeting\anymeeting.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Farbar) C:\Users\User\Desktop\FRST64 (1).exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13672152 2014-05-09] (Realtek Semiconductor)
HKLM\...\Run: [CorelCreatorClient] => C:\Program Files (x86)\Corel\Corel PDF Fusion\CorelCreatorClient.exe [779776 2011-08-24] (Global Graphics Software Ltd.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)
HKLM\...\Run: [Corel Update Helper] => c:\Program Files\Corel\Corel PaintShop Pro X7 (64-bit)\pua.exe [2004312 2015-05-19] (Corel Corporation)
HKLM-x32\...\Run: [JMB36X IDE Setup] => C:\Windows\RaidTool\xInsIDE.exe [43608 2010-09-07] ()
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [7780696 2013-08-22] (Acronis)
HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [1103424 2013-01-10] (Acronis)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Corel File Shell Monitor] => c:\Program Files (x86)\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\CorelIOMonitor.exe
HKLM-x32\...\Run: [Standby] => c:\Program Files (x86)\Common Files\Corel\Standby\Standby.exe [105632 2010-01-07] (Corel)
HKLM-x32\...\Run: [Corel Photo Downloader] => "C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel PhotoDownloader.exe" -startup
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKU\S-1-5-21-1225952976-927762924-3192494130-1002\...\Run: [Sococo] => C:\Program Files (x86)\Sococo\HUD\Sococo.exe [2695136 2015-01-08] (Sococo)
HKU\S-1-5-21-1225952976-927762924-3192494130-1002\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [28785280 2015-06-02] (Skype Technologies S.A.)
HKU\S-1-5-21-1225952976-927762924-3192494130-1002\...\Run: [Google Update] => C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2015-02-10] (Google Inc.)
HKU\S-1-5-21-1225952976-927762924-3192494130-1002\...\Run: [Google+ Auto Backup] => C:\Users\User\AppData\Local\Programs\Google\Google+ Auto Backup\Google+ Auto Backup.exe [3754312 2015-02-13] (Google Inc.)
HKU\S-1-5-21-1225952976-927762924-3192494130-1002\...\Run: [Boxoft Tools] => "C:\ProgramData\Boxtools\Boxofttoolbox.exe" -autorun
HKU\S-1-5-21-1225952976-927762924-3192494130-1002\...\Run: [Dropbox Update] => C:\Users\User\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-17] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AnyMeeting.lnk [2014-10-19]
ShortcutTarget: AnyMeeting.lnk -> C:\Windows\Installer\{76926884-B0F3-48AC-A5F1-65A8B68561EE}\_86EFB8A767D71CE5F41451.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CrashPlan Tray.lnk [2013-10-24]
ShortcutTarget: CrashPlan Tray.lnk -> C:\Program Files\CrashPlan\CrashPlanTray.exe (Code 42 Software, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass FF RunOnce.lnk [2014-10-30]
ShortcutTarget: Install LastPass FF RunOnce.lnk -> C:\Program Files (x86)\Common Files\lpuninstall.exe (LastPass)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass IE RunOnce.lnk [2014-10-30]
ShortcutTarget: Install LastPass IE RunOnce.lnk -> C:\Program Files (x86)\Common Files\lpuninstall.exe (LastPass)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RescueTime.lnk [2013-10-19]
ShortcutTarget: RescueTime.lnk -> C:\Program Files (x86)\RescueTime\RescueTime.exe (RescueTime, Inc.)
Startup: C:\Users\Carole\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Super Finder XT.lnk [2014-11-20]
ShortcutTarget: Super Finder XT.lnk -> C:\Program Files (x86)\FSL\SuperFinder\SuperFinder.exe (FSL)
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AnyMeeting.lnk [2015-03-01]
ShortcutTarget: AnyMeeting.lnk -> C:\Users\User\AppData\Roaming\Microsoft\Installer\{4DF71428-E2A8-4FED-8D67-B37D706D008F}\_0069DB8BE13A1BAE92D27C.exe ()
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-04-11]
ShortcutTarget: Dropbox.lnk -> C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Super Finder XT.lnk [2014-10-09]
ShortcutTarget: Super Finder XT.lnk -> C:\Program Files (x86)\FSL\SuperFinder\SuperFinder.exe (FSL)
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-08-07] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-08-07] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-08-07] (Acronis)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1225952976-927762924-3192494130-1002\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir...=ie&ar=msnhome
HKU\S-1-5-21-1225952976-927762924-3192494130-1002\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
HKU\S-1-5-21-1225952976-927762924-3192494130-1002\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_40\bin\ssv.dll [2015-03-03] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar_x64.dll [2014-10-30] (LastPass)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-03] (Oracle Corporation)
BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll [2009-01-26] (Safer Networking Limited)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-03] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar.dll [2014-10-30] (LastPass)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2013-12-18] (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-03] (Oracle Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2013-12-18] (Adobe Systems Incorporated)
Toolbar: HKLM - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll [2014-10-30] (LastPass)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2013-12-18] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll [2014-10-30] (LastPass)
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/s...irector/sw.cab
DPF: HKLM-x32 {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} http://catalog.update.microsoft.com/...?1382388852694
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 142.166.166.166
Tcpip\..\Interfaces\{CDBFE701-744D-4E9E-B6E8-4FF5B0CD50DE}: [DhcpNameServer] 192.168.2.1 142.166.166.166

**Cassel** · June 28th, 2015, 08:47 PM

And here is the second part of that log:

FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\6o1l1ku7.default
FF DefaultSearchUrl:
FF SelectedSearchEngine:
FF SelectedSearchEngine,S:
FF Homepage: hxxp://www.google.com/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll [2015-02-01] ()
FF Plugin: @garmin.com/GpsControl -> C:\Program Files\Garmin GPS Plugin\npGarmin.dll [2013-10-09] (GARMIN Corp.)
FF Plugin: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-03] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-03] (Oracle Corporation)
FF Plugin: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass64.dll [2014-10-30] (LastPass)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.2 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.3 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll [2015-02-01] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1211151.dll [2014-04-15] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @cnw.com/cnwplugin -> C:\Program Files (x86)\AnyMeeting\npcnwplugin.dll No File
FF Plugin-x32: @garmin.com/GpsControl -> C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll [2013-10-09] (GARMIN Corp.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-08-12] (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-03] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-03] (Oracle Corporation)
FF Plugin-x32: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass.dll [2014-10-30] (LastPass)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2013-09-12] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2013-09-12] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll No File
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.2 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.3 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll [2013-12-18] (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-12-21] (Adobe Systems Inc.)
FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin HKU\S-1-5-21-1225952976-927762924-3192494130-1002: @citrixonline.com/appdetectorplugin -> C:\Users\User\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2013-10-10] (Citrix Online)
FF Plugin HKU\S-1-5-21-1225952976-927762924-3192494130-1002: @cnw.com/cnwplugin -> C:\Users\User\AppData\Roaming\AnyMeeting\npcnwplugin.dll [2014-12-10] (AnyMeeting, Inc.)
FF Plugin HKU\S-1-5-21-1225952976-927762924-3192494130-1002: @tools.google.com/Google Update;version=3 -> C:\Users\User\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin HKU\S-1-5-21-1225952976-927762924-3192494130-1002: @tools.google.com/Google Update;version=9 -> C:\Users\User\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin HKU\S-1-5-21-1225952976-927762924-3192494130-1002: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Extension: LastPass - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\6o1l1ku7.default\Extensions\support@lastpass.com [2015-05-09]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2013-12-10]

Chrome:
=======
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-01]
CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-01]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-01]
CHR Extension: (Google Search) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-01]
CHR Extension: (Follow) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkakfimgbmogkpmjokgnbbanmmemcdij [2014-06-17]
CHR Extension: (Pin It Button) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic [2015-06-28]
CHR Extension: (LastPass: Free Password Manager) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2014-09-21]
CHR Extension: (Share As Image Extension) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\hgmhphfbdfbkokcfajipbmkcakmmepeb [2014-11-28]
CHR Extension: (Facebook Invite All) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\inmmhkeajgflmokoaaoadgkhhmibjbpj [2014-10-26]
CHR Extension: (Cookies) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\iphcomljdfghbkdcfndaijbokpgddeno [2014-08-29]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-22]
CHR Extension: (Text Highlighter) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd [2015-06-28]
CHR Extension: (iLivid) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf [2015-06-28]
CHR Extension: (Google Wallet) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-01]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-01]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AdobeActiveFileMonitor10.0; C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [169624 2011-09-14] (Adobe Systems Incorporated)
S2 AnviCsbSvc; C:\Program Files (x86)\Anvisoft\Cloud System Booster\CSBSvc.exe [318312 2012-12-14] ()
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-20] (Apple Inc.)
S2 astsvr; C:\Program Files (x86)\Anvisoft\Slim Toolbar\ToolBarService.exe [119480 2013-10-28] (Anvisoft)
S3 CorelCreatorMessages; C:\Windows\system32\CorelCreatorMessages.exe [105984 2011-08-24] (Global Graphics Software Ltd) [File not signed]
S2 CrashPlanService; C:\Program Files\CrashPlan\CrashPlanService.exe [222720 2013-04-08] (CrashPlan) [File not signed]
S2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
R2 MaConfigAgent; C:\Program Files\ma-config.com\MaConfigAgent.exe [2542416 2013-10-04] (CybelSoft)
S2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
S2 ProtexisLicensing; C:\Windows\SysWOW64\PSIService.exe [177704 2007-06-05] ()
S2 PSI_SVC_2; c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe [277360 2014-04-30] (arvato digital services llc)
R2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [337776 2014-04-30] (arvato digital services llc)
S2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1228504 2013-10-14] (Secunia)
S2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660184 2013-10-14] (Secunia)
S2 SococoSvc; C:\Program Files (x86)\Sococo\SococoService.exe [35296 2015-01-08] (Social Communications Company)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5495056 2015-06-18] (TeamViewer GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WTabletServiceCon; C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [656664 2014-08-19] (Wacom Technology, Corp.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-07] (Intel Corporation)
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [109272 2015-06-18] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-10-14] (Secunia)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2013-10-14] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [183224 2013-10-14] (Acronis)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [34808 2014-10-26] ()
R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [117024 2013-10-14] (Acronis International GmbH)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-28 21:40 - 2015-06-28 21:40 - 02112512 _____ (Farbar) C:\Users\User\Desktop\FRST64 (1).exe
2015-06-28 14:56 - 2015-06-28 14:56 - 00001269 _____ C:\Users\Public\Desktop\Corel PaintShop Pro X7 (64-bit).lnk
2015-06-28 14:56 - 2015-06-28 14:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Corel PaintShop Pro X7
2015-06-28 14:56 - 2015-06-28 14:56 - 00000000 ____D C:\Program Files\Common Files\Protexis
2015-06-28 13:54 - 2015-06-28 13:54 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wacom
2015-06-28 13:49 - 2015-06-28 13:49 - 00002267 _____ C:\Users\User\Desktop\JRT.txt
2015-06-20 13:17 - 2015-06-20 13:17 - 00000000 ____D C:\ProgramData\regid.1995-08.com.techsmith
2015-06-19 07:06 - 2015-06-19 07:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Corel PaintShop Pro X8
2015-06-17 20:54 - 2015-06-17 20:54 - 00000000 ____D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-06-17 20:52 - 2015-06-28 21:04 - 00000862 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1225952976-927762924-3192494130-1002Core.job
2015-06-17 20:52 - 2015-06-28 20:57 - 00000914 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1225952976-927762924-3192494130-1002UA.job
2015-06-17 20:52 - 2015-06-17 20:52 - 00003882 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1225952976-927762924-3192494130-1002UA
2015-06-17 20:52 - 2015-06-17 20:52 - 00003486 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1225952976-927762924-3192494130-1002Core
2015-06-17 20:52 - 2015-06-17 20:52 - 00000000 ____D C:\Users\User\AppData\Local\Dropbox
2015-06-17 20:52 - 2015-06-17 20:52 - 00000000 ____D C:\ProgramData\Dropbox
2015-06-10 14:24 - 2015-06-10 14:24 - 00000000 ____D C:\Users\Carole\AppData\Roaming\Corel
2015-06-10 04:58 - 2015-05-25 14:08 - 03206144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-10 04:58 - 2015-05-09 00:27 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-06-10 04:58 - 2015-05-09 00:27 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-06-10 04:58 - 2015-05-09 00:27 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-06-10 04:58 - 2015-05-09 00:27 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-06-10 04:58 - 2015-05-09 00:26 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-10 04:58 - 2015-05-09 00:26 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-06-10 04:58 - 2015-05-09 00:26 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-06-10 04:58 - 2015-05-09 00:25 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-06-10 04:58 - 2015-05-09 00:20 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:13 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-06-10 04:58 - 2015-05-09 00:13 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-06-10 04:58 - 2015-05-09 00:12 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-06-10 04:58 - 2015-05-09 00:12 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-06-10 04:58 - 2015-05-09 00:12 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 04:58 - 2015-05-09 00:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-06-10 04:58 - 2015-05-08 23:01 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-06-10 04:58 - 2015-05-08 23:01 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-06-10 04:58 - 2015-05-08 22:59 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-06-10 04:58 - 2015-05-08 22:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 04:58 - 2015-05-08 22:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 04:58 - 2015-05-08 22:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-06-10 04:58 - 2015-04-29 15:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-10 04:58 - 2015-04-29 15:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-10 04:58 - 2015-04-29 15:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-10 04:58 - 2015-04-29 15:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-10 04:58 - 2015-04-29 15:19 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-10 04:58 - 2015-04-29 15:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-06-10 04:58 - 2015-04-29 15:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-06-10 04:58 - 2015-04-29 15:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-06-10 04:58 - 2015-04-29 15:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-06-10 04:58 - 2015-04-29 15:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-06-10 04:58 - 2015-04-24 15:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-10 04:58 - 2015-04-24 14:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-06-10 04:57 - 2015-06-01 16:16 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-06-10 04:57 - 2015-06-01 15:07 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-06-10 04:57 - 2015-05-27 11:35 - 24917504 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-10 04:57 - 2015-05-27 11:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-06-10 04:57 - 2015-05-23 00:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-06-10 04:57 - 2015-05-23 00:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-06-10 04:57 - 2015-05-23 00:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-06-10 04:57 - 2015-05-23 00:15 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-06-10 04:57 - 2015-05-23 00:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-06-10 04:57 - 2015-05-23 00:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-06-10 04:57 - 2015-05-23 00:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-06-10 04:57 - 2015-05-23 00:09 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-06-10 04:57 - 2015-05-23 00:08 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-06-10 04:57 - 2015-05-23 00:06 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-06-10 04:57 - 2015-05-23 00:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-06-10 04:57 - 2015-05-23 00:05 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-06-10 04:57 - 2015-05-23 00:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-06-10 04:57 - 2015-05-22 23:57 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-06-10 04:57 - 2015-05-22 23:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-06-10 04:57 - 2015-05-22 23:49 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-06-10 04:57 - 2015-05-22 23:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-06-10 04:57 - 2015-05-22 23:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-06-10 04:57 - 2015-05-22 23:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-06-10 04:57 - 2015-05-22 23:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-06-10 04:57 - 2015-05-22 23:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-06-10 04:57 - 2015-05-22 23:37 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-06-10 04:57 - 2015-05-22 23:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-06-10 04:57 - 2015-05-22 23:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-06-10 04:57 - 2015-05-22 23:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-06-10 04:57 - 2015-05-22 23:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-06-10 04:57 - 2015-05-22 16:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-10 04:57 - 2015-05-22 16:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-06-10 04:57 - 2015-05-22 16:01 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-06-10 04:57 - 2015-05-22 16:00 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-10 04:57 - 2015-05-22 16:00 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-10 04:57 - 2015-05-22 16:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-10 04:57 - 2015-05-22 16:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-06-10 04:57 - 2015-05-22 15:59 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-06-10 04:57 - 2015-05-22 15:53 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-10 04:57 - 2015-05-22 15:52 - 06026240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-10 04:57 - 2015-05-22 15:52 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-06-10 04:57 - 2015-05-22 15:48 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-10 04:57 - 2015-05-22 15:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-10 04:57 - 2015-05-22 15:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-06-10 04:57 - 2015-05-22 15:47 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-10 04:57 - 2015-05-22 15:47 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-06-10 04:57 - 2015-05-22 15:40 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-06-10 04:57 - 2015-05-22 15:36 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-10 04:57 - 2015-05-22 15:29 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-06-10 04:57 - 2015-05-22 15:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-06-10 04:57 - 2015-05-22 15:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-10 04:57 - 2015-05-22 15:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-10 04:57 - 2015-05-22 15:07 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-06-10 04:57 - 2015-05-22 15:06 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-10 04:57 - 2015-05-22 15:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-10 04:57 - 2015-05-22 15:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-06-10 04:57 - 2015-05-22 14:57 - 14404096 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-10 04:57 - 2015-05-22 14:50 - 02426880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-10 04:57 - 2015-05-22 14:38 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-10 04:57 - 2015-05-22 14:26 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-31 11:17 - 2015-06-28 21:38 - 00000652 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1225952976-927762924-3192494130-1002.job
2015-05-31 11:17 - 2015-06-13 23:54 - 00003686 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-1225952976-927762924-3192494130-1002

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-28 21:41 - 2014-10-27 22:06 - 00034194 _____ C:\Users\User\Desktop\FRST.txt
2015-06-28 21:41 - 2014-10-27 22:06 - 00000000 ____D C:\FRST
2015-06-28 21:41 - 2013-10-08 16:22 - 00000000 ____D C:\Users\User\AppData\Roaming\Skype
2015-06-28 21:36 - 2014-10-30 20:13 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-28 20:44 - 2015-02-10 21:28 - 00000904 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1225952976-927762924-3192494130-1002UA.job
2015-06-28 20:43 - 2014-01-29 22:00 - 00000556 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1225952976-927762924-3192494130-1002.job
2015-06-28 19:44 - 2015-02-10 21:28 - 00000852 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1225952976-927762924-3192494130-1002Core.job
2015-06-28 18:37 - 2014-11-05 20:17 - 00000000 ____D C:\Users\User\AppData\Local\AnyMeeting
2015-06-28 14:58 - 2013-10-09 20:27 - 00000000 ____D C:\ProgramData\Corel
2015-06-28 14:57 - 2013-10-12 23:22 - 00000000 ____D C:\Users\User\AppData\Local\CrashDumps
2015-06-28 14:56 - 2013-10-08 15:09 - 01504053 _____ C:\Windows\WindowsUpdate.log
2015-06-28 14:35 - 2013-10-09 19:51 - 00000000 ____D C:\Users\User\Documents\My PSP Files
2015-06-28 13:54 - 2015-01-10 20:17 - 00013522 _____ C:\Windows\setupact.log
2015-06-28 13:53 - 2013-10-09 18:59 - 00000000 ____D C:\Program Files\Tablet
2015-06-28 13:47 - 2015-01-10 19:09 - 00000000 ____D C:\Users\User\AppData\Local\Sococo
2015-06-28 13:45 - 2014-01-27 18:30 - 00000000 ____D C:\Utilities
2015-06-28 12:36 - 2014-10-30 20:13 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-28 11:46 - 2009-07-14 01:45 - 00021872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-28 11:46 - 2009-07-14 01:45 - 00021872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-28 11:42 - 2014-03-01 14:58 - 00000000 ___RD C:\Users\User\Dropbox
2015-06-28 11:42 - 2014-03-01 14:54 - 00000000 ____D C:\Users\User\AppData\Roaming\Dropbox
2015-06-28 11:35 - 2013-10-08 17:49 - 00000000 ____D C:\ProgramData\NVIDIA
2015-06-28 11:35 - 2009-07-14 02:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-28 11:34 - 2015-01-23 00:29 - 00163924 _____ C:\Windows\PFRO.log
2015-06-28 11:34 - 2014-05-26 19:54 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-06-28 11:32 - 2014-10-27 21:42 - 00000000 ____D C:\AdwCleaner
2015-06-28 10:20 - 2013-11-04 21:50 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-27 23:44 - 2013-11-24 21:05 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2015-06-27 22:31 - 2014-05-26 19:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-06-27 12:23 - 2013-10-12 16:08 - 00000000 ____D C:\Users\User\AppData\Roaming\EasyVideoSuite
2015-06-25 02:51 - 2015-02-20 23:34 - 00001023 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2015-06-20 18:37 - 2013-10-09 21:19 - 00005120 _____ C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-06-20 13:17 - 2014-08-24 15:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TechSmith
2015-06-20 13:17 - 2014-01-03 16:47 - 00000000 ____D C:\Program Files (x86)\TechSmith
2015-06-20 13:17 - 2013-10-12 00:07 - 00000000 ____D C:\ProgramData\TechSmith
2015-06-20 13:10 - 2013-10-12 00:09 - 00000000 ____D C:\Users\User\Documents\Camtasia Studio
2015-06-19 20:33 - 2013-12-02 12:00 - 00000000 ____D C:\Program Files (x86)\Notepad++
2015-06-19 07:13 - 2013-10-09 20:30 - 00000000 ____D C:\Users\User\Documents\Corel PaintShop Pro
2015-06-19 07:13 - 2013-10-09 20:30 - 00000000 ____D C:\Users\User\AppData\Local\Corel PaintShop Pro
2015-06-19 07:07 - 2013-10-14 15:54 - 00000000 ____D C:\Program Files\Corel
2015-06-19 07:04 - 2013-10-09 20:27 - 00000000 ____D C:\Program Files (x86)\Corel
2015-06-18 19:25 - 2013-10-19 23:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RescueTime
2015-06-18 19:25 - 2013-10-19 23:47 - 00000000 ____D C:\Program Files (x86)\RescueTime
2015-06-18 08:41 - 2014-05-26 19:54 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-18 08:41 - 2013-11-04 21:50 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-18 08:41 - 2012-07-16 14:12 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-17 22:30 - 2009-07-14 02:13 - 00784286 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-13 23:54 - 2014-01-29 22:00 - 00003590 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-1225952976-927762924-3192494130-1002
2015-06-13 18:00 - 2009-07-14 00:20 - 00000000 ____D C:\Windows\system32\NDF
2015-06-13 09:06 - 2013-10-08 15:41 - 00000000 ____D C:\ProgramData\Skype
2015-06-13 06:22 - 2009-07-14 00:20 - 00000000 ____D C:\Windows\rescache
2015-06-11 06:31 - 2009-07-14 02:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-06-11 03:47 - 2012-07-17 09:49 - 04994696 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-11 03:44 - 2009-07-14 00:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-06-11 03:27 - 2012-07-16 16:18 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-11 03:03 - 2013-10-08 17:12 - 00000000 ____D C:\Windows\system32\MRT
2015-06-11 03:02 - 2012-07-16 14:45 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-10 14:32 - 2014-11-20 21:23 - 00000000 ____D C:\Users\Carole\AppData\Local\Google
2015-06-10 14:24 - 2015-02-12 05:50 - 00000000 ____D C:\Users\Carole\AppData\Local\Sococo
2015-06-10 14:23 - 2014-11-20 21:23 - 00126344 _____ C:\Users\Carole\AppData\Local\GDIPFONTCACHEV1.DAT
2015-06-02 16:37 - 2015-05-17 17:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

==================== Files in the root of some directories =======

2014-09-21 11:29 - 2014-10-30 20:34 - 15000576 _____ (LastPass) C:\Program Files (x86)\Common Files\lpuninstall.exe
2014-07-24 21:55 - 2014-07-24 21:55 - 0000132 _____ () C:\Users\User\AppData\Roaming\Adobe PNG Format CS5 Prefs
2013-10-09 21:19 - 2015-06-20 18:37 - 0005120 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-04-05 12:56 - 2015-04-05 14:15 - 0000000 _____ () C:\Users\User\AppData\Local\flip.txt
2015-04-05 13:05 - 2015-04-05 13:07 - 1546435 _____ () C:\Users\User\AppData\Local\flip.zip
2015-04-05 12:56 - 2015-04-05 14:15 - 0000022 _____ () C:\Users\User\AppData\Local\pdfFli.ini
2015-04-05 13:05 - 2015-04-05 13:07 - 0000197 _____ () C:\Users\User\AppData\Local\settings.ini
2014-03-22 10:29 - 2014-03-22 10:29 - 0000020 _____ () C:\Users\User\AppData\Local\UACBrResultRetrieving.dat
2014-11-08 22:42 - 2014-11-08 22:42 - 0000008 __RSH () C:\ProgramData\A35F90C2C9.sys
2015-01-23 00:36 - 2015-01-23 00:36 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-10-17 18:48 - 2015-03-12 06:41 - 0003140 ___SH () C:\ProgramData\KGyGaAvL.sys

Some files in TEMP:
====================
C:\Users\User\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpay3t9y.dll
C:\Users\User\AppData\Local\Temp\jre-8u40-windows-au.exe
C:\Users\User\AppData\Local\Temp\npp.6.7.5.Installer.exe
C:\Users\User\AppData\Local\Temp\npp.6.7.8.2.Installer.exe
C:\Users\User\AppData\Local\Temp\Quarantine.exe
C:\Users\User\AppData\Local\Temp\RescueTimeInstaller.exe
C:\Users\User\AppData\Local\Temp\setup.exe
C:\Users\User\AppData\Local\Temp\SkypeSetup.exe
C:\Users\User\AppData\Local\Temp\sqlite3.dll
C:\Users\User\AppData\Local\Temp\xmlUpdater.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-06-23 14:20

==================== End of log ============================

**Cassel** · June 28th, 2015, 08:48 PM

For the Addition.txt file, the only one i have is dated from October. Would you need that too? It is probably because it is not the first run of that program (even though i re-downloaded it in case it was a different version).

**Broni** · June 29th, 2015, 08:12 PM

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
If you're stuck, or you're not sure about certain step, always ask before doing anything else.
Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
Never run more than one scan at a time.
Keep updating me regarding your computer behavior, good, or bad.
The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

============================

Re-run FRST and checkmark "Addition.txt" box.

**Cassel** · June 29th, 2015, 08:28 PM

Here is the first part of the Addition.txt file:

Additional scan result of Farbar Recovery Scan Tool (x64) Version:28-06-2015 01
Ran by User at 2015-06-29 21:25:32
Running from C:\Users\User\Desktop
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1225952976-927762924-3192494130-500 - Administrator - Disabled)
Carole (S-1-5-21-1225952976-927762924-3192494130-1010 - Administrator - Enabled) => C:\Users\Carole
Guest (S-1-5-21-1225952976-927762924-3192494130-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-1225952976-927762924-3192494130-1009 - Limited - Enabled)
UpdatusUser (S-1-5-21-1225952976-927762924-3192494130-1003 - Limited - Enabled) => C:\Users\UpdatusUser
User (S-1-5-21-1225952976-927762924-3192494130-1002 - Administrator - Enabled) => C:\Users\User

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
2007 Microsoft Office Suite Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Acronis True Image 2014 (HKLM-x32\...\{1F91344A-B963-4431-89E8-4F80DEE282BE}Visible) (Version: 17.0.5560 - Acronis)
Acronis True Image 2014 (x32 Version: 17.0.5560 - Acronis) Hidden
Adobe Acrobat X Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.9 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.110 - Adobe Systems Incorporated)
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.5.23 - Adobe Systems Incorporated.)
Adobe Content Viewer (HKLM-x32\...\com.adobe.dmp.contentviewer) (Version: 1.4.0 - Adobe Systems Incorporated)
Adobe Creative Suite 5.5 Design Standard (HKLM-x32\...\{53CF3920-648B-4F99-8D05-6A6C5298F57B}) (Version: 5.5 - Adobe Systems Incorporated)
Adobe Flash Player 14 ActiveX (HKLM-x32\...\{C4B95D2E-BDE6-412D-AF7B-EC43A298C55B}) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Photoshop Elements 10 (HKLM-x32\...\Adobe Photoshop Elements 10) (Version: 10.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.1.151 - Adobe Systems, Inc.)
akFontViewer (HKLM-x32\...\akFontViewer) (Version: - )
Amazon Kindle (HKU\S-1-5-21-1225952976-927762924-3192494130-1002\...\Amazon Kindle) (Version: - Amazon)
AMP Font Viewer (HKLM-x32\...\AMP Font Viewer) (Version: - )
AnyMeeting (HKLM-x32\...\{4DF71428-E2A8-4FED-8D67-B37D706D008F}) (Version: 3.1.0 - AnyMeeting, Inc.)
AnyMeeting (HKLM-x32\...\{76926884-B0F3-48AC-A5F1-65A8B68561EE}) (Version: 2.5.0 - AnyMeeting, Inc.)
Apple Application Support (32-bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audacity 2.0.3 (HKLM-x32\...\Audacity_is1) (Version: 2.0.3 - Audacity Team)
Balsamiq Mockups For Desktop (HKLM-x32\...\BalsamiqMockupsForDesktop.EDE15CF69E11F7F7D45B5430C7D37CC6C3545E3C.1) (Version: 2.2.21 - Balsamiq SRL)
Balsamiq Mockups For Desktop (x32 Version: 2.2.21 - Balsamiq SRL) Hidden
BenVista PhotoZoom Pro 2.3 (HKLM-x32\...\PhotoZoom Pro 2) (Version: 2.3 - BenVista Ltd)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brosix (HKU\S-1-5-21-1225952976-927762924-3192494130-1002\...\Brosix) (Version: 3.6.1 - Brosix)
Bulk Rename Utility 2.7.1.3 (HKLM\...\Bulk Rename Utility_is1) (Version: - TGRMN Software)
Camtasia Studio 8 (HKLM-x32\...\{5303CFB5-D635-44F0-A94B-9611E81F07C4}) (Version: 8.3.0.1471 - TechSmith Corporation)
CCleaner (HKLM\...\CCleaner) (Version: 3.20 - Piriform)
Cfont Pro v4 (HKLM-x32\...\Cfont Pro_is1) (Version: - Veign, LLC)
Citrix Online Launcher (HKLM-x32\...\{AC7E7905-8C59-4806-A96D-30936A2B1FC5}) (Version: 1.0.168 - Citrix)
Cloud System Booster (HKLM-x32\...\Cloud System Booster) (Version: 2.1 - Anvisoft)
CloudBerry Explorer for Amazon S3 3.8.2 (HKLM\...\CloudBerry Explorer for Amazon S3) (Version: 3.8.2 - CloudBerryLab)
CollageIt 1.9.3 (HKLM-x32\...\{D9757258-30B2-496E-86F2-84920C5858E1}_is1) (Version: 1.9.3 - PearlMountain Technology Co., Ltd)
Contents (x32 Version: 1.6.1.109 - Corel Corporation) Hidden
Contents (x32 Version: 16.1.0.45 - Corel Corporation) Hidden
Corel Paint Shop Pro Photo X2 (HKLM-x32\...\{64E72FB1-2343-4977-B4A8-262CD53D0BD3}) (Version: 12.001.0000 - Corel Corporation)
Corel Paint Shop Pro Photo XI (HKLM-x32\...\{93A1B09E-BAFA-4628-A5B6-921CB026955A}) (Version: 11.00.0000 - Corel Inc)
Corel Paint Shop Pro X (HKLM-x32\...\{1A15507A-8551-4626-915D-3D5FA095CC1B}) (Version: 10.01 - Corel Inc)
Corel PaintShop Photo Pro X3 (HKLM-x32\...\_{D1AEB5DB-04FA-489D-94EF-8600898B93EE}) (Version: 1.6.1.109 - Corel Corporation)
Corel PaintShop Photo Pro X3 (x32 Version: 1.00.0000 - Corel Corporation) Hidden
Corel PaintShop Pro X4 (HKLM-x32\...\_{00580795-581C-4587-B9F2-37320D7AB37F}) (Version: 14.0.0.332 - Corel Corporation)
Corel PaintShop Pro X4 (x32 Version: 14.2.0.1 - Corel Corporation) Hidden
Corel PaintShop Pro X5 (HKLM-x32\...\_{1563C6F2-E9B5-42DE-9EA6-207C9A8C2DFB}) (Version: 15.0.0.183 - Corel Corporation)
Corel PaintShop Pro X5 (x32 Version: 15.0.0.183 - Corel Corporation) Hidden
Corel PaintShop Pro X6 (HKLM-x32\...\_{166D1CB6-DD8A-40DD-9E25-4D31D2D6DE4D}) (Version: 16.2.0.20 - Corel Corporation)
Corel PaintShop Pro X6 (x32 Version: 16.2.0.20 - Corel Corporation) Hidden
Corel PaintShop Pro X7 (HKLM-x32\...\_{176F50D6-6857-49CE-B731-65F757EE3F0D}) (Version: 17.3.0.30 - Corel Corporation)
Corel PaintShop Pro X8 (HKLM-x32\...\_{85C69B9B-F9BD-4A60-BD83-F2B7E081ED39}) (Version: 18.0.0.101 - Corel Corporation)
Corel PaintShop Pro X8 (x32 Version: 18.0.0.101 - Corel Corporation) Hidden
Corel PDF Fusion (HKLM\...\{2D769EF2-E9FE-4AC6-8990-15C39E1D68BF}) (Version: 1.00.0000 - Corel Corporation)
Corel PDF Fusion Add-ins (x32 Version: 1.0.0 - Corel Corporation) Hidden
Corel VideoStudio Ultimate X6 (HKLM-x32\...\_{6688A246-F6E8-48AD-9806-8D5832E9F15D}) (Version: 16.1.0.45 - Corel Corporation)
CrashPlan (HKLM\...\{FCE35118-DD2F-4DB8-A5B6-D857F95669E0}) (Version: 3.5.3 - CrashPlan)
Creative Content (x32 Version: 1.0.0.100 - Corel Corporation) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DeviceIO (x32 Version: 1.6.1.109 - Corel Corporation) Hidden
Dropbox (HKU\S-1-5-21-1225952976-927762924-3192494130-1002\...\Dropbox) (Version: 3.6.7 - Dropbox, Inc.)
EasyVideoSuite (HKLM-x32\...\{626ED56A-F33D-4DE9-A2EF-2473E3475904}) (Version: 1.0.0 - WebActix)
Elements 10 Organizer (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Filter Forge 4.012 (HKLM-x32\...\Filter Forge 4_is1) (Version: - Filter Forge, Inc.)
FindThatFont! 1.0 (HKLM-x32\...\FindThatFont!) (Version: 1.0 - mathijs.jurresip.nl)
Font Runner 3 (64-bit) (HKLM\...\{4E8CC211-5FDC-4E41-81F3-A30214F587E4}) (Version: 3.2.4 - Crux Technologies, Inc.)
Font Viewer 2.0 (HKLM-x32\...\Font Viewer_is1) (Version: - Thinking BIG Information Technology Inc.)
Free Flip Book Maker (HKLM-x32\...\Free Flip Book Maker_is1) (Version: - FlipPageMaker Solution)
Free Online Flipbook Creator (HKLM-x32\...\Free Online Flipbook Creator_is1) (Version: - 3dpageflip Solution)
Free Page Flip Book Maker (HKLM-x32\...\Free Page Flip Book Maker_is1) (Version: - flippdf Solution)
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 1.0.1 - )
FreshKey (HKLM-x32\...\FreshKey) (Version: 1.5.3 - Infomastery, LLC)
FreshKey (x32 Version: 1.5.3 - Infomastery, LLC) Hidden
Garmin Communicator Plugin (HKLM-x32\...\{032A13FF-D26D-4844-9597-7EF698627985}) (Version: 4.1.0 - Garmin Ltd or its subsidiaries)
Garmin Communicator Plugin x64 (HKLM\...\{AFA301E1-B410-4F1B-B1C0-2E92FDCD94AD}) (Version: 4.1.0 - Garmin Ltd or its subsidiaries)
Git version 1.8.5.2-preview20131230 (HKLM-x32\...\Git_is1) (Version: 1.8.5.2-preview20131230 - The Git Development Community)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.130 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
Google+ Auto Backup (HKU\S-1-5-21-1225952976-927762924-3192494130-1002\...\Google+ Auto Backup) (Version: 1.0.27.161 - Google, Inc.)
GoToMeeting 7.2.1.2856 (HKU\S-1-5-21-1225952976-927762924-3192494130-1002\...\GoToMeeting) (Version: 7.2.1.2856 - CitrixOnline)
High-Definition Video Playback 10 (x32 Version: 7.0.11400.29.0 - Nero AG) Hidden
High-Logic FontCreator 6.5 (HKLM-x32\...\FontCreator6_is1) (Version: - High-Logic B.V.)
High-Logic FontCreator 8 (HKLM-x32\...\FontCreator8_is1) (Version: - High-Logic B.V.)
ICA (x32 Version: 1.6.1.109 - Corel Corporation) Hidden
ICA (x32 Version: 14.0.0.332 - Corel Corporation) Hidden
ICA (x32 Version: 15.0.0.183 - Corel Corporation) Hidden
ICA (x32 Version: 16.0.0.113 - Corel Corporation) Hidden
ICA (x32 Version: 16.1.0.45 - Corel Corporation) Hidden
ICA (x32 Version: 17.3.0.30 - Corel Corporation) Hidden
ICA (x32 Version: 18.0.0.101 - Corel Corporation) Hidden
ImageSkill Magic Enhancer Lite 1 (Remove only) (HKLM-x32\...\ImageSkill Magic Enhancer Lite 1) (Version: 1.0 - ImageSkill)
Inpaint 6.0 (HKLM\...\{2AEDC172-479F-47AE-8A48-A0524D4AED5B}_is1) (Version: - Teorex)
Intel(R) Network Connections 18.7.28.0 (HKLM\...\PROSetDX) (Version: 18.7.28.0 - Intel)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)
IPM_PSP_COM (x32 Version: 14.0.0.332 - Corel Corporation) Hidden
IPM_PSP_COM (x32 Version: 15.0.0.183 - Corel Corporation) Hidden
IPM_PSP_COM (x32 Version: 16.0.0.113 - Corel Corporation) Hidden
IPM_PSP_COM (x32 Version: 18.0.0.101 - Corel Corporation) Hidden
IPM_PSP_COM64 (Version: 16.0.0.113 - Corel Corporation) Hidden
IPM_PSP_COM64 (Version: 17.3.0.30 - Corel Corporation) Hidden
IPM_PSP_COM64 (Version: 18.0.0.101 - Corel Corporation) Hidden
IPM_PSP_Pro (x32 Version: 1.00.0000 - Corel Corporation) Hidden
IPM_VS_Pro (x32 Version: 16.0 - Corel Corporation) Hidden
iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)
Jasc Paint Shop Pro 8 (HKLM-x32\...\{81A34902-9D0B-4920-A25C-4CDC5D14B328}) (Version: 8.01.0000 - Jasc Software Inc)
Jasc Paint Shop Pro 8.10 Update Patch (HKLM-x32\...\Jasc Paint Shop Pro 8.10 Update Patch) (Version: - )
Jasc Paint Shop Pro 9 (HKLM-x32\...\{F843C6A3-224D-4615-94F8-3C461BD9AEA0}) (Version: 9.00.0000 - Jasc Software Inc)
Jasc Paint Shop Pro 9.01 Patch (HKLM-x32\...\Jasc Paint Shop Pro 9.01 Patch) (Version: - )
Java 8 Update 40 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418040F0}) (Version: 8.0.400 - Oracle Corporation)
Java 8 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)
Java(TM) 6 Update 33 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216033FF}) (Version: 6.0.330 - Oracle)
Jing (HKLM-x32\...\{22800204-9E53-45C7-B6F3-5BB0F1C1A147}) (Version: 2.8.13007.1 - TechSmith Corporation)
JMicron JMB36X Driver (HKLM-x32\...\{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}) (Version: 1.17.65.11 - JMicron Technology Corp.)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
K-Lite Codec Pack 10.0.5 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.0.5 - )
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )
LastPass (uninstall only) (HKLM-x32\...\LastPass) (Version: - LastPass)
Ma-Config.com (64 bits) (HKLM\...\{9FB986F0-6B3B-4DE9-BA98-D48A8444C615}) (Version: 7.0.193 - Cybelsoft)
Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Market Samurai (HKLM-x32\...\MarketSamurai.6E37012E1CBD7F47B14488FCC715944F3EBDCEDC.1) (Version: 0.93.00 - Alliance Software Pty Ltd)
Market Samurai (x32 Version: 0.93.00 - Alliance Software Pty Ltd) Hidden
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Primary Interop Assemblies (HKLM-x32\...\{50120000-1105-0000-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0409-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1225952976-927762924-3192494130-1002\...\OneDriveSetup.exe) (Version: 17.0.4035.0328 - Microsoft Corporation)
Microsoft Primary Interoperability Assemblies 2005 (HKLM-x32\...\{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{86CE1746-9EFF-3C9C-8755-81EA8903AC34}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
MLE (x32 Version: 1.0.0.23 - Corel Corporation) Hidden
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 38.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 en-US)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Namo WebEditor 2006 (HKLM-x32\...\{980A3C34-1652-472D-84AC-2A4D3D4955BF}) (Version: 7.00.000 - Sejoong Namo Interactive, Inc.)
Nero BackItUp 10 (HKLM-x32\...\{68AB6930-5BFF-4FF6-923B-516A91984FE6}) (Version: 5.4.11600.19.100 - Nero AG)
Nero Burning ROM 10 (HKLM-x32\...\{7A5D731D-B4B3-490E-B339-75685712BAAB}) (Version: 10.0.11100.10.100 - Nero AG)
Nero BurnRights 10 (HKLM-x32\...\{943CFD7D-5336-47AF-9418-E02473A5A517}) (Version: 4.0.11000.12.100 - Nero AG)
Nero CoverDesigner 10 (HKLM-x32\...\{FCF00A6E-FB58-477A-ABE9-232907105521}) (Version: 5.0.10900.11.100 - Nero AG)
Nero DiscSpeed 10 (HKLM-x32\...\{34490F4E-48D0-492E-8249-B48BECF0537C}) (Version: 6.0.10800.7.100 - Nero AG)
Nero Express 10 (HKLM-x32\...\{70550193-1C22-445C-8FA4-564E155DB1A7}) (Version: 10.0.11000.10.100 - Nero AG)
Nero InfoTool 10 (HKLM-x32\...\{F412B4AF-388C-4FF5-9B2F-33DB1C536953}) (Version: 7.0.10800.8.100 - Nero AG)
Nero MediaHub 10 (HKLM-x32\...\{1F7FB68F-52F6-46A3-B42F-38CE46295AE5}) (Version: 1.0.13400.11.100 - Nero AG)
Nero Multimedia Suite 10 (HKLM-x32\...\{277C1559-4CF7-44FF-8D07-98AA9C13AABD}) (Version: 10.0.13100 - Nero AG)
Nero Recode 10 (HKLM-x32\...\{8ECEC853-5C3D-4B10-B5C7-FF11FF724807}) (Version: 4.6.10900.4.100 - Nero AG)
Nero RescueAgent 10 (HKLM-x32\...\{E337E787-CF61-4B7B-B84F-509202A54023}) (Version: 3.0.10900.9.100 - Nero AG)
Nero SoundTrax 10 (HKLM-x32\...\{E1EE5339-5D32-458F-BAAB-B19F6301BCE2}) (Version: 4.6.10600.2.100 - Nero AG)
Nero StartSmart 10 (HKLM-x32\...\{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}) (Version: 10.0.11200.12.100 - Nero AG)
Nero Vision 10 (HKLM-x32\...\{9A4297F3-2A51-4ED9-92CA-4BCB8380947E}) (Version: 7.0.11100.8.100 - Nero AG)
Nero WaveEditor 10 (HKLM-x32\...\{EDCDFAD5-DF80-4600-A493-E9DAD6810230}) (Version: 5.6.10600.2.100 - Nero AG)
NexusFont 2.5 (ver 2.5.8.1582) (HKLM-x32\...\{EFEDD205-43FE-4208-B682-0937E803E19E}_is1) (Version: - xiles)
Node.js (HKLM\...\{5A050774-DD97-4FD5-A591-1D7A5BC80EB6}) (Version: 0.10.25 - Joyent, Inc. and other Node contributors)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.8.2 - Notepad++ Team)
NVIDIA 3D Vision Driver 327.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 327.23 - NVIDIA Corporation)
NVIDIA Graphics Driver 327.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.23 - NVIDIA Corporation)
NVIDIA Update 1.14.17 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.14.17 - NVIDIA Corporation)
OnlineJobs.ph TimeProof App 2.08 (HKLM-x32\...\{B47A013C-5A1C-4F79-A3B8-92C2940836B8}) (Version: 2.08 - OnlineJobs.ph)
Opcion Font Viewer (HKLM-x32\...\{B86688D9-0F85-458B-AFB1-5B3B4C8CE541}) (Version: 1.1.1 - Chiu Software Systems)
Origin (HKLM-x32\...\Origin) (Version: 9.4.12.2807 - Electronic Arts, Inc.)
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
PDF to Flash Converter (freeware) (HKLM-x32\...\PDF to Flash Converter (freeware)_is1) (Version: - flippagemaker Solution)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
PSE10 STI Installer (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
PSPH10Pro (x32 Version: 1.00.0000 - Corel Corporation) Hidden
PSPPContent (x32 Version: 1.00.0000 - Corel Corporation) Hidden
PSPPContent (x32 Version: 14.0.0.332 - Corel Corporation) Hidden
PSPPContent (x32 Version: 15.0.0.183 - Corel Corporation) Hidden
PSPPContent (x32 Version: 16.0.0.113 - Corel Corporation) Hidden
PSPPContent (x32 Version: 17.3.0.30 - Corel Corporation) Hidden
PSPPContent (x32 Version: 18.0.0.101 - Corel Corporation) Hidden
PSPPHelp (x32 Version: 14.0.0.332 - Corel Corporation) Hidden
PSPPHelp (x32 Version: 15.0.0.183 - Corel Corporation) Hidden
PSPPHelp (x32 Version: 16.0.0.113 - Corel Corporation) Hidden
PSPPHelp (x32 Version: 17.3.0.30 - Corel Corporation) Hidden
PSPPHelp (x32 Version: 18.0.0.101 - Corel Corporation) Hidden
PSPPRO_DCRAW (x32 Version: 13.0.0 - Corel Corporation) Hidden
PSPPro64 (Version: 14.0.0.332 - Corel Corporation) Hidden
PSPPro64 (Version: 15.0.0.183 - Corel Corporation) Hidden
PSPPro64 (Version: 16.2.0.20 - Corel Corporation) Hidden
PSPPro64 (Version: 17.3.0.30 - Corel Corporation) Hidden
PSPPro64 (Version: 18.0.0.101 - Corel Corporation) Hidden
PureHD (x32 Version: 1.6.1.109 - Corel Corporation) Hidden
Python 3.3.3 (64-bit) (HKLM\...\{e9d90870-ab19-32a8-aa93-f8348ba21d05}) (Version: 3.3.3150 - Python Software Foundation)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.30164 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7246 - Realtek Semiconductor Corp.)
RescueTime 2.10.2.1355 (HKLM-x32\...\{2505571C-03B3-4F9F-AC35-33F1CB4B5E9E}_is1) (Version: - RescueTime.com)
Revo Uninstaller Pro 3.1.1 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.1 - VS Revo Group, Ltd.)
Secunia PSI (3.0.0.8013) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.8013 - Secunia)
Setup (x32 Version: 1.6.1.109 - Corel Corporation) Hidden
Setup (x32 Version: 14.0.0.332 - Corel Corporation) Hidden
Setup (x32 Version: 15.0.0.183 - Corel Corporation) Hidden
Setup (x32 Version: 16.0.0.113 - Corel Corporation) Hidden
Setup (x32 Version: 16.1.0.45 - Corel Corporation) Hidden
Setup (x32 Version: 17.3.0.30 - Corel Corporation) Hidden
Setup (x32 Version: 18.0.0.101 - Corel Corporation) Hidden
Share (x32 Version: 1.6.1.109 - Corel Corporation) Hidden
Share (x32 Version: 16.1.0.45 - Corel Corporation) Hidden
Share64 (Version: 1.6.1.109 - Corel Corporation) Hidden
Share64 (Version: 16.1.0.45 - Corel Corporation) Hidden
SimpleMind desktop Pro 1.9.3d (HKLM-x32\...\SMPRO1_is1) (Version: 1.9.3d - ModelMaker Tools BV)
Skype™ 7.5 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.5.102 - Skype Technologies S.A.)
Slim Toolbar 1.2 (HKLM-x32\...\Slim Toolbar) (Version: 1.2 - Anvisoft)
SmartSound Common Data (HKLM-x32\...\InstallShield_{B8A2869E-30CA-40C5-9CF8-BD7354E57EF8}) (Version: 1.1.0 - SmartSound Software Inc.)
SmartSound Common Data (x32 Version: 1.1.0 - SmartSound Software Inc.) Hidden
SmartSound Quicktracks 5 (HKLM-x32\...\InstallShield_{2F8BA3FD-1FA9-4279-B696-712ABB12F09F}) (Version: 5.1.6 - SmartSound Software Inc.)
SmartSound Quicktracks 5 (x32 Version: 5.1.6 - SmartSound Software Inc.) Hidden
Sococo (HKLM-x32\...\{69FE1E40-CE73-11DD-72AE-0808570E2CD6}) (Version: 3.5.5.12287 - Social Communications Company)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Super Finder XT 1.6.3.2 (HKLM-x32\...\Super Finder XT_is1) (Version: - FSL - FreeSoftLand)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.43879 - TeamViewer)
The Sims 2: Ultimate Collection (HKLM-x32\...\{04450C18-F039-4B81-A621-70C3B0F523D5}) (Version: 1.0.0.0 - Electronic Arts)
Tweaking.com - Windows Repair (HKLM-x32\...\Tweaking.com - Windows Repair) (Version: 3.2.0 - Tweaking.com)
TwistedBrush Pro Studio (HKU\S-1-5-21-1225952976-927762924-3192494130-1002\...\TwistedBrush Pro Studio) (Version: - )
UltraCompare (HKLM-x32\...\{A85EF459-3CF5-4E1C-A1B0-1125265A03AE}) (Version: 8.50.1026 - IDM Computer Solutions, Inc.)
UltraEdit (HKLM-x32\...\InstallShield_{635A6AF2-63AF-4C1C-AF57-BDC8AF6D397D}) (Version: 19.00.1022 - IDM Computer Solutions, Inc.)
UltraEdit (x32 Version: 19.00.1022 - IDM Computer Solutions, Inc.) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
UserTesting.com Recorder Plugin (HKU\S-1-5-21-1225952976-927762924-3192494130-1002\...\UserTestingPlugin) (Version: - UserTesting.com)
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
VeryPDF Flipbook Maker v2.0 (HKLM-x32\...\VeryPDF Flipbook Maker v2.0_is1) (Version: - VeryPDF.com Company)
VIO (x32 Version: 1.6.1.109 - Corel Corporation) Hidden
Visual Studio 2005 Tools for Office Second Edition Runtime (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Office Runtime) (Version: - Microsoft Corporation)
VSClassic (x32 Version: 16.1.0.45 - Corel Corporation) Hidden
VSHelp (x32 Version: 16.1.0.45 - Corel Corporation) Hidden
VSUltimate (x32 Version: 16.1.0.45 - Corel Corporation) Hidden
Wacom (HKLM\...\Pen Tablet Driver) (Version: 5.3.5-3 - Wacom Technology Corp.)
WebTablet FB Plugin 32 bit (HKLM-x32\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.7 - Wacom Technology Corp.)
WebTablet FB Plugin 64 bit (HKLM\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.7 - Wacom Technology Corp.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Media Encoder 9 Series (HKLM-x32\...\Windows Media Encoder 9) (Version: - )
WinRAR archiver (HKLM-x32\...\WinRAR archiver) (Version: - )
WinZip 18.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240E1}) (Version: 18.0.11023 - WinZip Computing, S.L. )

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1225952976-927762924-3192494130-1002_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1225952976-927762924-3192494130-1002_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\User\AppData\Local\Citrix\GoToMeeting\1350\G2MOutlookAddin64.dll No File
CustomCLSID: HKU\S-1-5-21-1225952976-927762924-3192494130-1002_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1225952976-927762924-3192494130-1002_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1225952976-927762924-3192494130-1002_Classes\CLSID\{C3B42C03-C1B7-4c1a-B384-BBAE19646333}\InprocServer32 -> C:\Program Files (x86)\IDM Computer Solutions\UltraCompare\UC_ShellExt64.dll ()
CustomCLSID: HKU\S-1-5-21-1225952976-927762924-3192494130-1002_Classes\CLSID\{ca586c80-7c84-4b88-8537-726724df6929}\InprocServer32 -> C:\Program Files (x86)\Git\git-cheetah\git_shell_ext64.dll ()
CustomCLSID: HKU\S-1-5-21-1225952976-927762924-3192494130-1002_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1225952976-927762924-3192494130-1002_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1225952976-927762924-3192494130-1002_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1225952976-927762924-3192494130-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\FileSyncApi64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1225952976-927762924-3192494130-1002_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1225952976-927762924-3192494130-1002_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1225952976-927762924-3192494130-1002_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1225952976-927762924-3192494130-1002_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1225952976-927762924-3192494130-1002_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1225952976-927762924-3192494130-1002_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1225952976-927762924-3192494130-1002_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1225952976-927762924-3192494130-1002_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)

==================== Restore Points =========================

26-05-2015 03:00:12 Windows Update
29-05-2015 23:33:15 Windows Update
31-05-2015 22:31:31 Installed Camtasia Studio 8
01-06-2015 23:24:39 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
01-06-2015 23:25:09 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030
02-06-2015 17:50:31 Windows Update
06-06-2015 17:48:21 Windows Update
11-06-2015 03:00:13 Windows Update
14-06-2015 07:42:21 Windows Update
18-06-2015 07:43:03 Windows Update
19-06-2015 07:02:53 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
19-06-2015 07:03:18 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030
20-06-2015 13:12:23 Removed Camtasia Studio 8
20-06-2015 13:16:52 Installed Camtasia Studio 8
22-06-2015 04:29:15 Windows Update
26-06-2015 04:29:43 Windows Update
28-06-2015 14:53:11 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030
29-06-2015 11:47:58 Windows Update

**Cassel** · June 29th, 2015, 08:29 PM

And the second part of it.

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 23:34 - 2014-10-27 21:09 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0A46860E-35EC-4606-9B0F-9D9F6E1ECD10} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-06-22] (Piriform Ltd)
Task: {0BB189AF-E526-4C20-8581-62FDCF1569B8} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1225952976-927762924-3192494130-1002Core => C:\Users\User\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-17] (Dropbox, Inc.)
Task: {195ECDDF-ED23-49C7-B625-766B9416B5A2} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1225952976-927762924-3192494130-1002UA => C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe [2015-02-10] (Google Inc.)
Task: {21C8E6FE-5E6F-44FB-BEB5-F6C6EBF67346} - System32\Tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTask => C:\Windows\system32\Wat\WatAdminSvc.exe [2013-10-08] (Microsoft Corporation)
Task: {2ECD1CEF-CEA3-4CF5-9530-A066C0E7CD56} - System32\Tasks\{A9BE7075-F541-4CFA-8896-A1A8096077F7} => pcalua.exe -a C:\Windows\system32\pcwrun.exe -c "C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\Corel Paint Shop Pro Photo.exe"
Task: {3622D613-FA14-432B-B406-4221A70512A6} - System32\Tasks\{BB7A402E-EAB7-41B9-846A-2630FDBEC466} => C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\Corel Paint Shop Pro Photo.exe [2007-08-28] (Corel, Inc.)
Task: {3D06E2B4-D437-47FE-AF47-8BBB52B1BA5A} - System32\Tasks\G2MUploadTask-S-1-5-21-1225952976-927762924-3192494130-1002 => C:\Users\User\AppData\Local\Citrix\GoToMeeting\2856\g2mupload.exe [2015-06-13] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {6B8AF58A-E609-4E29-824D-EFB037D75264} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1225952976-927762924-3192494130-1002UA => C:\Users\User\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-17] (Dropbox, Inc.)
Task: {918D2A61-CCBB-4326-9BD1-EA667AC10F84} - System32\Tasks\{32C68AEC-B391-45DB-84A0-F1E83598A95D} => pcalua.exe -a C:\CaroleDeskTop\Utilitaire\revouninstaller\revouninstaller-portable\Revouninstaller.exe -d C:\CaroleDeskTop\Utilitaire\revouninstaller\revouninstaller-portable
Task: {A814B8EF-8276-4B0D-8614-4B4EEDF3EF72} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-30] (Google Inc.)
Task: {AB99512A-6BF6-4173-B885-3B7669CF2448} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-01] (Adobe Systems Incorporated)
Task: {B2473E96-A754-42FB-A7DF-168B3092AE8D} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1225952976-927762924-3192494130-1002Core => C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe [2015-02-10] (Google Inc.)
Task: {B633A040-1717-4AD3-B8CA-F0B5AB6521D0} - System32\Tasks\{0CA6D72B-5473-4813-848F-849053C7745B} => pcalua.exe -a C:\CaroleDeskTop\PSP2\Originals\pspXI\PaintShopPro1100_EN_DE_FR_ES_IT_NL_CORELTBYB_ESD.exe -d C:\CaroleDeskTop\PSP2\Originals\pspXI
Task: {D4F89E8C-A9A4-4BDA-BB85-83656F663DA2} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {D6594BFF-2D96-46A5-B1FD-F16E84C0E7A9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-30] (Google Inc.)
Task: {E1A8C478-3FCB-4F70-80D0-C2DC74155669} - System32\Tasks\AdobeAAMUpdater-1.0-CAROLEDESKTOP-User => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-06-16] (Adobe Systems Incorporated)
Task: {F8FDC4CE-2ACD-4674-B0CC-D3CEBE83DE1F} - System32\Tasks\Tweaking.com - Windows Repair Tray Icon => C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\WR_Tray_Icon.exe [2015-03-11] (Tweaking.com)
Task: {FA0AE436-200B-4B9D-8725-25B2FFFAB4C3} - System32\Tasks\G2MUpdateTask-S-1-5-21-1225952976-927762924-3192494130-1002 => C:\Users\User\AppData\Local\Citrix\GoToMeeting\2856\g2mupdate.exe [2015-06-13] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {FA601954-BBEE-40FC-9F46-5AC64795AC94} - System32\Tasks\{1D9BEA5D-A445-4BA1-83EE-94710FDE3C0F} => pcalua.exe -a E:\Carole\PSP\Originals\pspXII\PSPP12_Corel_TBYB_EN_IE_FR_DE_ES_IT_NL_ESD.exe -d E:\Carole\PSP\Originals\pspXII
Task: {FFFD7507-D0DA-49EF-8E17-D3736250BFD0} - System32\Tasks\{B8315877-0C85-4348-A19E-6D1B08A6DDA7} => pcalua.exe -a C:\CaroleDeskTop\Resources\tbrusha.exe -d C:\CaroleDeskTop\Resources
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1225952976-927762924-3192494130-1002Core.job => C:\Users\User\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1225952976-927762924-3192494130-1002UA.job => C:\Users\User\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1225952976-927762924-3192494130-1002.job => C:\Users\User\AppData\Local\Citrix\GoToMeeting\2856\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1225952976-927762924-3192494130-1002.job => C:\Users\User\AppData\Local\Citrix\GoToMeeting\2856\g2mupload.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1225952976-927762924-3192494130-1002Core.job => C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1225952976-927762924-3192494130-1002UA.job => C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2013-10-12 13:45 - 2010-03-15 11:28 - 00052224 _____ () C:\Program Files (x86)\WinRAR\rarext64.dll
2013-06-21 20:13 - 2013-06-21 20:13 - 00102400 _____ () C:\Program Files (x86)\IDM Computer Solutions\UltraCompare\UC_ShellExt64.dll
2014-01-27 18:35 - 2013-12-27 23:35 - 00721571 _____ () C:\Program Files (x86)\Git\git-cheetah\git_shell_ext64.dll
2009-12-30 19:48 - 2009-12-30 19:48 - 00124560 _____ () c:\Program Files (x86)\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\PSPContextMenu64.dll
2015-04-15 17:13 - 2015-04-15 17:13 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2015-01-08 16:34 - 2015-01-08 16:39 - 00475104 _____ () C:\Program Files (x86)\Sococo\HUD\SococoBrowser.exe
2011-08-24 09:24 - 2011-08-24 09:24 - 00146432 _____ () C:\Windows\System32\corelcreatorpm.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2013-10-09 18:59 - 2014-08-19 16:12 - 01356568 _____ () C:\Program Files\Tablet\Pen\libxml2.dll
2013-03-02 11:10 - 2013-03-02 11:10 - 00790968 _____ () C:\Program Files\Corel\Corel PaintShop Pro X6 (64-bit)\PsiClient.dll
2014-02-21 18:32 - 2014-02-21 18:32 - 06636856 _____ () C:\Program Files\Corel\Corel PaintShop Pro X6 (64-bit)\uipp.dll
2014-05-08 15:50 - 2014-05-08 15:50 - 00798576 _____ () C:\Program Files\Corel\Corel PaintShop Pro X7 (64-bit)\PsiClient.dll
2015-05-22 13:36 - 2015-05-22 13:36 - 06635832 _____ () C:\Program Files\Corel\Corel PaintShop Pro X7 (64-bit)\uipp.dll
2015-05-22 13:36 - 2015-05-22 13:36 - 00684856 _____ () C:\Program Files\Corel\Corel PaintShop Pro X7 (64-bit)\sqlite3x64.dll
2014-12-10 11:20 - 2014-12-10 11:20 - 50935552 _____ () C:\Users\User\AppData\Roaming\AnyMeeting\anymeeting.exe
2010-03-27 14:01 - 2007-04-16 10:50 - 01740800 _____ () E:\Carole\PSP\utilitaires\FileZilla_2_2_32\FileZilla.exe
2014-11-20 19:04 - 2014-11-20 19:04 - 00054272 ____S () C:\Program Files (x86)\WebActix\EasyVideoSuite\screen-capture-recorder.dll
2015-04-15 19:11 - 2015-04-15 19:11 - 00014336 _____ () C:\Program Files (x86)\Notepad++\plugins\NppExport.dll
2015-05-15 11:24 - 2015-05-15 11:24 - 02873856 _____ () C:\Program Files (x86)\Notepad++\plugins\NppFTP.dll
2015-01-08 16:34 - 2015-01-08 16:39 - 40628704 _____ () C:\Program Files (x86)\Sococo\HUD\libcef.dll
2015-01-08 16:34 - 2015-01-08 16:39 - 00917472 _____ () C:\Program Files (x86)\Sococo\HUD\libglesv2.dll
2015-01-08 16:34 - 2015-01-08 16:39 - 00140256 _____ () C:\Program Files (x86)\Sococo\HUD\libegl.dll
2013-08-22 11:38 - 2013-08-22 11:38 - 00028992 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\thread_pool.dll
2013-08-22 11:41 - 2013-08-22 11:41 - 00420160 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\ulxmlrpcpp.dll
2014-03-31 21:35 - 2014-03-31 21:35 - 00270016 _____ () C:\Program Files (x86)\Windows Live\Writer\en\WindowsLive.Writer.Localization.resources.dll
2004-08-16 09:00 - 2004-11-09 09:01 - 00438272 _____ () C:\Program Files (x86)\Jasc Software Inc\Paint Shop Pro 9\igJPEG2K13d.dll
2014-12-10 11:21 - 2014-12-10 11:21 - 00904576 _____ () C:\Users\User\AppData\Roaming\AnyMeeting\libglesv2.dll
2014-12-10 11:21 - 2014-12-10 11:21 - 00106880 _____ () C:\Users\User\AppData\Roaming\AnyMeeting\libegl.dll
2014-12-10 11:20 - 2014-12-10 11:20 - 00886656 _____ () C:\Users\User\AppData\Roaming\AnyMeeting\ffmpegsumo.dll
2015-06-28 18:37 - 2015-06-28 18:37 - 16841392 _____ () C:\Users\User\AppData\Local\Temp\nw7532_817\plugins\NPSWF32_15_0_0_239.dll
2015-06-22 18:39 - 2015-06-20 02:46 - 01281864 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\libglesv2.dll
2015-06-22 18:38 - 2015-06-20 02:46 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\libegl.dll
2015-06-22 18:39 - 2015-06-20 02:46 - 15003976 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1225952976-927762924-3192494130-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\User\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1 - 142.166.166.166

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Secunia PSI Tray.lnk => C:\Windows\pss\Secunia PSI Tray.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MyPC Backup.lnk => C:\Windows\pss\MyPC Backup.lnk.Startup
MSCONFIG\startupfolder: C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk => C:\Windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
MSCONFIG\startupfolder: C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Super Finder XT.lnk => C:\Windows\pss\Super Finder XT.lnk.Startup
MSCONFIG\startupreg: Acrobat Assistant 8.0 => "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
MSCONFIG\startupreg: Acronis Scheduler2 Service => "C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe"
MSCONFIG\startupreg: Adobe Acrobat Speed Launcher => "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: AdobeCS5.5ServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: CloudSystemBooster => C:\Program Files (x86)\Anvisoft\Cloud System Booster\CloudSystemBooster.exe hide=true
MSCONFIG\startupreg: Corel Photo Downloader => "C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
MSCONFIG\startupreg: CorelCreatorClient => C:\Program Files (x86)\Corel\Corel PDF Fusion\CorelCreatorClient.exe
MSCONFIG\startupreg: EVS => C:\Program Files (x86)\WebActix\EasyVideoSuite\EasyVideoSuite.exe
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: Optimizer Pro => C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: RTHDVCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
MSCONFIG\startupreg: ToolbarTray => C:\Program Files (x86)\Anvisoft\Slim Toolbar\ToolbarTray.exe

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{31DCD5AF-3727-49D7-8FE2-0F3EB8D7C2F6}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{464488F4-D63F-4CA6-BC23-4E4B6D160B3D}] => (Allow) LPort=48113
FirewallRules: [{583CA588-524C-4AAC-A839-3546B8550FBB}] => (Allow) LPort=48114
FirewallRules: [{83D045FE-D17B-43C0-86AF-68942D2C17F6}] => (Allow) C:\Program Files\ma-config.com\MaConfigAgent.exe
FirewallRules: [{A6B624A2-7143-45B4-B097-17CB0059AE36}] => (Allow) C:\Program Files\ma-config.com\MaConfigAgent.exe
FirewallRules: [{7F634AB5-56DF-4BF5-AB17-13E33DED9E11}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{02C12C37-8DBF-4A08-ACCD-6B0B9CC5CF94}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{1A942AA6-F1D6-4A47-9797-A81A18065E3B}] => (Allow) C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{44046997-2C77-4C8C-8E7A-772F152EE00E}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{C5603CB9-E456-4EC3-A788-0630A7C9136D}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [TCP Query User{49CD1F85-D009-46C7-A7BE-FB0D491ACCAE}C:\users\user\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe] => (Block) C:\users\user\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe
FirewallRules: [UDP Query User{5E63E27E-78EA-4416-861D-1CAE65B445D2}C:\users\user\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe] => (Block) C:\users\user\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe
FirewallRules: [TCP Query User{1DABA9F5-9516-4C74-81B7-D2F1286E7AC0}C:\program files (x86)\namo\webeditor 2006\bin\webeditor.exe] => (Allow) C:\program files (x86)\namo\webeditor 2006\bin\webeditor.exe
FirewallRules: [UDP Query User{A6C722FF-38EF-495D-B9CF-0076F494F8EA}C:\program files (x86)\namo\webeditor 2006\bin\webeditor.exe] => (Allow) C:\program files (x86)\namo\webeditor 2006\bin\webeditor.exe
FirewallRules: [{8A461BB3-2DA0-488B-B463-716C4BE7D344}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{56B13C79-568D-4E7F-996E-2B7F1DBB812C}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{4C23D923-31D5-425D-A4B4-3823E2489CAD}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{D5990AF1-A6F1-470D-B31A-A9775D91F97B}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{CBDD842F-EFB2-4F72-8B45-E3D701238884}] => (Allow) C:\Program Files\CrashPlan\CrashPlanService.exe
FirewallRules: [{3002979C-3AC5-4B5D-A8AE-B96724D10B2C}] => (Allow) C:\Program Files\CrashPlan\CrashPlanService.exe
FirewallRules: [{5A5DD42B-4D85-45D3-91AC-73AE9076BBD7}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{AE4F769C-3B22-468A-9F3A-9796EF936F24}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [TCP Query User{147A88E5-F8A1-476F-996D-32BD7D9E48A2}E:\carole\psp\utilitaires\filezilla_2_2_32\filezilla.exe] => (Allow) E:\carole\psp\utilitaires\filezilla_2_2_32\filezilla.exe
FirewallRules: [UDP Query User{6E6BF08F-3656-4D35-816B-ABECFB9FE4AE}E:\carole\psp\utilitaires\filezilla_2_2_32\filezilla.exe] => (Allow) E:\carole\psp\utilitaires\filezilla_2_2_32\filezilla.exe
FirewallRules: [{3902FC3F-BFD7-4DEC-B96E-20813CA06925}] => (Allow) C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{DB3503EE-2FC1-412B-B52D-A949316D2762}] => (Allow) C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{01D22ACD-4A65-45C8-B78A-D9F094F459C8}C:\users\user\brosix\brosix.exe] => (Allow) C:\users\user\brosix\brosix.exe
FirewallRules: [UDP Query User{B2FACB47-F6D0-4EF6-857E-2EB071946738}C:\users\user\brosix\brosix.exe] => (Allow) C:\users\user\brosix\brosix.exe
FirewallRules: [{572762A7-972D-4E74-B820-B95651332072}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{FE485236-E193-4FCE-9FC6-3673CBE10FD2}] => (Allow) LPort=2869
FirewallRules: [{02020365-32F1-4E22-BE17-0631CC105425}] => (Allow) LPort=1900
FirewallRules: [{A4531763-4E4E-419A-912A-5CE386A1D5B8}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{A6F09851-45E1-45CE-BBA1-8FB50CCEDD1C}] => (Allow) C:\Program Files (x86)\Origin Games\The Sims 2 Ultimate Collection\Fun with Pets\SP9\TSBin\Sims2EP9.exe
FirewallRules: [{B3FC79A6-03FE-4823-A686-DD55A0A5DDA0}] => (Allow) C:\Program Files (x86)\Origin Games\The Sims 2 Ultimate Collection\Fun with Pets\SP9\TSBin\Sims2EP9.exe
FirewallRules: [{CFBF2571-E33D-4AC1-8F3E-063F8827F8E4}] => (Allow) C:\Program Files (x86)\ModelMakerTools\SimpleMind\1.9.3\iPhoneLink.exe
FirewallRules: [{4793973D-A8C1-45CA-BE34-E00E9D84425E}] => (Allow) C:\Program Files (x86)\Sococo\HUD\Sococo.exe
FirewallRules: [{7E2E65D9-0544-485B-A179-C6ECBD7C3916}] => (Allow) C:\Program Files (x86)\Sococo\HUD\Sococo.exe
FirewallRules: [{6A4D766C-C3ED-4A10-8548-105A8DE9F6B8}] => (Allow) C:\Program Files (x86)\Sococo\SococoService.exe
FirewallRules: [{52C25BB3-76B5-46FB-9A96-C0631E3B979D}] => (Allow) C:\Program Files (x86)\Sococo\SococoService.exe
FirewallRules: [{79F9931C-66DF-4B07-A9CC-B97E795F3879}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{70964ABB-57F7-42C0-9FA7-04F6EBBB77AC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{4491B925-231C-4E38-B24B-4480CC52B08E}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{48FBC5E6-BD49-48A6-B834-63CE9FD5EF38}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{A60842C3-BAA7-49B5-957D-FD73BBD01B7C}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{F66B55D8-48A7-4145-A8BD-035F2F80C4F4}] => (Allow) LPort=8317
FirewallRules: [{08AB705D-CC23-4739-9BCC-A67E9DCE3E0D}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{00450080-9F7A-438E-A90C-2E19FCEAFCA0}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{B1D8A9A8-7DED-41A4-8AD6-C2C282B4D3D3}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{9E2945DE-38D5-4281-8C1B-BADCCD0F5FA8}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{D94E8EB5-F8ED-41B3-B4EA-BF9B934B6879}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (06/29/2015 09:15:56 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program chrome.exe version 43.0.2357.130 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 6e4

Start Time: 01d0b1c2c6e8e481

Termination Time: 10

Application Path: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Report Id:

Error: (06/29/2015 07:15:32 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: FileZilla.exe, version: 2.2.32.0, time stamp: 0x462338c7
Faulting module name: FileZilla.exe, version: 2.2.32.0, time stamp: 0x462338c7
Exception code: 0xc0000005
Fault offset: 0x000fe6d0
Faulting process id: 0x3f8
Faulting application start time: 0xFileZilla.exe0
Faulting application path: FileZilla.exe1
Faulting module path: FileZilla.exe2
Report Id: FileZilla.exe3

Error: (06/28/2015 02:57:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Corel PaintShop Pro.exe, version: 17.0.0.3, time stamp: 0x555eb68c
Faulting module name: Corel PaintShop Pro.exe, version: 17.0.0.3, time stamp: 0x555eb68c
Exception code: 0xc0000005
Fault offset: 0x0000000000106160
Faulting process id: 0xe50
Faulting application start time: 0xCorel PaintShop Pro.exe0
Faulting application path: Corel PaintShop Pro.exe1
Faulting module path: Corel PaintShop Pro.exe2
Report Id: Corel PaintShop Pro.exe3

Error: (06/28/2015 02:45:28 PM) (Source: MsiInstaller) (EventID: 11706) (User: CAROLEDESKTOP)
Description: Product: ICA -- Error 1706.No valid source could be found for product ICA. The Windows Installer cannot continue.

Error: (06/28/2015 02:45:28 PM) (Source: MsiInstaller) (EventID: 11706) (User: CAROLEDESKTOP)
Description: Product: IPM_PSP_COM64 -- Error 1706.No valid source could be found for product IPM_PSP_COM64. The Windows Installer cannot continue.

Error: (06/28/2015 02:45:27 PM) (Source: MsiInstaller) (EventID: 11706) (User: CAROLEDESKTOP)
Description: Product: PSPPro64 -- Error 1706.No valid source could be found for product PSPPro64. The Windows Installer cannot continue.

Error: (06/28/2015 02:45:26 PM) (Source: MsiInstaller) (EventID: 11706) (User: CAROLEDESKTOP)
Description: Product: IPM_PSP_COM -- Error 1706.No valid source could be found for product IPM_PSP_COM. The Windows Installer cannot continue.

Error: (06/28/2015 02:45:26 PM) (Source: MsiInstaller) (EventID: 11706) (User: CAROLEDESKTOP)
Description: Product: PSPPHelp -- Error 1706.No valid source could be found for product PSPPHelp. The Windows Installer cannot continue.

Error: (06/28/2015 02:45:25 PM) (Source: MsiInstaller) (EventID: 11706) (User: CAROLEDESKTOP)
Description: Product: PSPPContent -- Error 1706.No valid source could be found for product PSPPContent. The Windows Installer cannot continue.

Error: (06/28/2015 02:45:25 PM) (Source: MsiInstaller) (EventID: 11706) (User: CAROLEDESKTOP)
Description: Product: Corel PaintShop Pro X7 -- Error 1706.No valid source could be found for product Corel PaintShop Pro X7. The Windows Installer cannot continue.

System errors:
=============
Error: (06/29/2015 11:50:30 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume WIN7.

Error: (06/29/2015 11:50:28 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume WIN7.

Error: (06/29/2015 11:50:25 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume WIN7.

Error: (06/29/2015 11:46:18 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureCommand with the following error:
%%5

Error: (06/29/2015 11:46:16 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for Start with the following error:
%%5

Error: (06/29/2015 00:43:09 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume WIN7.

Error: (06/29/2015 00:43:07 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume WIN7.

Error: (06/29/2015 00:43:04 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume WIN7.

Error: (06/28/2015 02:56:25 PM) (Source: Ntfs) (EventID: 55) (User: )
Description: The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume WIN7.

Error: (06/28/2015 02:56:22 PM) (Source: Ntfs) (EventID: 55) (User: )
Description: The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume WIN7.

Microsoft Office:
=========================
Error: (05/24/2015 00:33:10 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6718.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 886036 seconds with 840 seconds of active time. This session ended with a crash.

Error: (05/09/2015 04:51:42 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6718.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 499049 seconds with 2700 seconds of active time. This session ended with a crash.

Error: (02/16/2015 11:52:48 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6715.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 227989 seconds with 7320 seconds of active time. This session ended with a crash.

Error: (12/28/2014 10:12:23 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6713.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 297615 seconds with 14040 seconds of active time. This session ended with a crash.

Error: (11/30/2014 04:47:05 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 577210 seconds with 2400 seconds of active time. This session ended with a crash.

CodeIntegrity Errors:
===================================
Date: 2014-10-27 21:08:43.508
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-10-27 21:08:43.484
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-10-27 21:08:43.459
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-10-27 21:08:43.434
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-05-27 23:17:16.248
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-05-27 23:17:16.202
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-05-27 23:17:16.170
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-05-27 23:17:16.124
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-05-27 22:38:36.012
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-05-27 22:38:35.969
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

==================== Memory info ===========================

Processor: Intel(R) Core(TM) i3 CPU 530 @ 2.93GHz
Percentage of memory in use: 47%
Total physical RAM: 8119.06 MB
Available physical RAM: 4226.51 MB
Total Pagefile: 16236.32 MB
Available Pagefile: 11380.93 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (WIN7) (Fixed) (Total:931.41 GB) (Free:436.93 GB) NTFS
Drive d: (Carole) (CDROM) (Total:0.11 GB) (Free:0 GB) CDFS
Drive e: (Acer) (Fixed) (Total:683.54 GB) (Free:158.38 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive g: (FANTOM) (Fixed) (Total:931.5 GB) (Free:455.19 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: AF2AE78F)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: 2BD2C32A)
Partition 1: (Not Active) - (Size=15 GB) - (Type=27)
Partition 2: (Not Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=683.5 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 931.5 GB) (Disk ID: F87B4C9A)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End of log ============================

**Broni** · June 29th, 2015, 09:02 PM

So far I don't see much...

Download RogueKiller from one of the following links and save it to your Desktop:

Link 1
Link 2

Close all the running programs
Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
Otherwise just double-click on RogueKiller.exe
Pre-scan will start. Let it finish.
Click on SCAN button.
Wait until the Status box shows Scan Finished
Click on Delete.
Wait until the Status box shows Deleting Finished.
Click on Report and copy/paste the content of the Notepad into your next reply.
RKreport.txt could also be found on your desktop.
If more than one log is produced post all logs.
If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

Please download Malwarebytes Anti-Malware (MBAM) to your desktop.
NOTE. If you already have MBAM 2.0 installed scroll down.

Double-click mbam-setup-2.0.0.1000.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
- Launch Malwarebytes Anti-Malware
- A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
Click Finish.
On the Dashboard, click the 'Update Now >>' link
After the update completes, click the 'Scan Now >>' button.
Or, on the Dashboard, click the Scan Now >> button.
If an update is available, click the Update Now button.
A Threat Scan will begin.
When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
In most cases, a restart will be required.
Wait for the prompt to restart the computer to appear, then click on Yes.

If you already have MBAM 2.0 installed:

On the Dashboard, click the 'Update Now >>' link
After the update completes, click the 'Scan Now >>' button.
Or, on the Dashboard, click the Scan Now >> button.
If an update is available, click the Update Now button.
A Threat Scan will begin.
When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
In most cases, a restart will be required.
Wait for the prompt to restart the computer to appear, then click on Yes.

How to get logs:
(Export log to save as txt)

After the restart once you are back at your desktop, open MBAM once more.
Click on the History tab > Application Logs.
Double click on the Scan Log which shows the Date and time of the scan just performed.
Click 'Export'.
Click 'Text file (*.txt)'
In the Save File dialog box which appears, click on Desktop.
In the File name: box type a name for your scan log.
A message box named 'File Saved' should appear stating "Your file has been successfully exported".
Click Ok
Attach that saved log to your next reply.

(Copy to clipboard for pasting into forum replies or tickets)

After the restart once you are back at your desktop, open MBAM once more.
Click on the History tab > Application Logs.
Double click on the Scan Log which shows the Date and time of the scan just performed.
Click 'Copy to Clipboard'
Paste the contents of the clipboard into your reply.

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on adwcleaner.exe to run the tool.
Click on Scan button.
When the scan has finished click on Clean button.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the contents of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[S1].txt as well.

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

**Cassel** · June 29th, 2015, 09:45 PM

RogueKiller report:

RogueKiller V10.8.7.0 [Jun 29 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : User [Administrator]
Started from : C:\Users\User\Desktop\RogueKiller.exe
Mode : Delete -- Date : 06/29/2015 22:42:46

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 14 ¤¤¤
[Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-1225952976-927762924-3192494130-1002\Software\Microsoft\Windows\CurrentVersion\Run | Boxoft Tools : "C:\ProgramData\Boxtools\Boxofttoolbox.exe" -autorun [x][x] -> Not selected
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-1225952976-927762924-3192494130-1002\Software\Microsoft\Windows\CurrentVersion\Run | Boxoft Tools : "C:\ProgramData\Boxtools\Boxofttoolbox.exe" -autorun [x][x] -> Not selected
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_E_126B\ControlSet001\Services\YahooAUService ("C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe") -> Not selected
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_E_126B\ControlSet002\Services\YahooAUService ("C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe") -> Not selected
[PUM.SearchPage] (X64) HKEY_USERS\RK_user_ON_E_E816\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Not selected
[PUM.SearchPage] (X86) HKEY_USERS\RK_user_ON_E_E816\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Not selected
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_E_126B\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 192.168.2.1 142.177.2.130 [-][CANADA (CA)] -> Not selected
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_E_126B\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 192.168.2.1 142.177.2.130 [-][CANADA (CA)] -> Not selected
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_E_126B\ControlSet001\Services\Tcpip\Parameters\Interfaces\{76DBE9A6-982E-47DE-9147-123E9D36040F} | DhcpNameServer : 8.8.8.8 4.2.2.1 10.0.0.1 [-][-][(Private Address) (XX)] -> Not selected
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_E_126B\ControlSet001\Services\Tcpip\Parameters\Interfaces\{7D3C5B2F-3681-4C51-954F-851D2081994F} | DhcpNameServer : 192.168.2.1 142.177.2.130 [-][CANADA (CA)] -> Not selected
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_E_126B\ControlSet001\Services\Tcpip\Parameters\Interfaces\{BC9D54B6-D2C9-42AC-8F4C-190A44F0DF9D} | DhcpNameServer : 192.168.2.1 142.177.2.130 [-][CANADA (CA)] -> Not selected
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_E_126B\ControlSet002\Services\Tcpip\Parameters\Interfaces\{76DBE9A6-982E-47DE-9147-123E9D36040F} | DhcpNameServer : 8.8.8.8 4.2.2.1 10.0.0.1 [-][-][(Private Address) (XX)] -> Not selected
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_E_126B\ControlSet002\Services\Tcpip\Parameters\Interfaces\{7D3C5B2F-3681-4C51-954F-851D2081994F} | DhcpNameServer : 192.168.2.1 142.177.2.130 [-][CANADA (CA)] -> Not selected
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_E_126B\ControlSet002\Services\Tcpip\Parameters\Interfaces\{BC9D54B6-D2C9-42AC-8F4C-190A44F0DF9D} | DhcpNameServer : 192.168.2.1 142.177.2.130 [-][CANADA (CA)] -> Not selected

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 1 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost

¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000036b]) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD10EZEX-00ZF5A0 SCSI Disk Device +++++
--- User ---
[MBR] 6a0e1db3ad2e871dbfcf611729a2aef9
[BSP] 2d2c7c32997e022f8b5a9d0d7c7587ac : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 953767 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
Error reading LL2 MBR! ([18] The program issued a command but the command length is incorrect. )

+++++ PhysicalDrive1: WDC WD7500AVDS-63U8B SCSI Disk Device +++++
--- User ---
[MBR] 385e72240a879394f4b0026820d295c0
[BSP] 55d57d3e41aa878a2341aeb65fa94d4f : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 15360 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 31459328 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 31664128 | Size: 699942 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
Error reading LL2 MBR! ([18] The program issued a command but the command length is incorrect. )

+++++ PhysicalDrive2: MICRONET FANTOM DRIVE USB Device +++++
--- User ---
[MBR] 06f124675604a573815bd973a2612e8d
[BSP] 35a28c61f53c4867a290f03a4732c7ec : Windows XP|VT.Unknown MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 953859 MB [Windows XP Bootstrap | Windows XP Bootloader]
User = LL1 ... OK
Error reading LL2 MBR! ([32] The request is not supported. )

============================================
RKreport_SCN_10262014_225159.log - RKreport_DEL_10262014_225633.log - RKreport_SCN_06292015_224116.log

**Cassel** · June 29th, 2015, 10:27 PM

After running MBAM and finishing the scan, i get the Threat Scan Result, where nothing is checked and i have the NEXT button to click. At this point, i do not have the Apply Action option. Even if i check all the threats, i don't see that option.

Any suggestion?

**Broni** · June 29th, 2015, 11:14 PM

When you checkmark all threats what option do you have?

**Cassel** · June 29th, 2015, 11:33 PM

I have REMOVE SELECTED. It would be the logical click but didn't want to do anything NOT in the instructions!

**Broni** · June 30th, 2015, 12:06 AM

Yes, go ahead with that action.

**Cassel** · June 30th, 2015, 06:07 AM

OK this is the log file (it didn't ask for a reboot)

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 29/06/2015
Scan Time: 10:52 PM
Logfile: mbam-2015-06-30.txt
Administrator: Yes

Version: 2.1.8.1057
Malware Database: v2015.06.29.06
Rootkit Database: v2015.06.26.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: User

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 709562
Time Elapsed: 26 min, 34 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 13
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd, Quarantined, [b2c8427e13773df9c4a1eedc36cd669a],
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\0.1_0, Quarantined, [b2c8427e13773df9c4a1eedc36cd669a],
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\0.1_0\_metadata, Quarantined, [b2c8427e13773df9c4a1eedc36cd669a],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\common, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\config, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\newtab, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\newtab\js, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\settings, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\settings\common, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\settings\partner, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\_metadata, Quarantined, [5822fac63a504cea4e03579ff70cdb25],

Files: 20
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\0.1_0\background.js, Quarantined, [b2c8427e13773df9c4a1eedc36cd669a],
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\0.1_0\icon-128.png, Quarantined, [b2c8427e13773df9c4a1eedc36cd669a],
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\0.1_0\icon-16.png, Quarantined, [b2c8427e13773df9c4a1eedc36cd669a],
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\0.1_0\icon-48.png, Quarantined, [b2c8427e13773df9c4a1eedc36cd669a],
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\0.1_0\manifest.json, Quarantined, [b2c8427e13773df9c4a1eedc36cd669a],
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\0.1_0\script.js, Quarantined, [b2c8427e13773df9c4a1eedc36cd669a],
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\0.1_0\_metadata\verified_contents.json, Quarantined, [b2c8427e13773df9c4a1eedc36cd669a],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\manifest.json, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\common\aes.js, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\common\config.js, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\common\config.js.bak, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\common\mode-ecb.js, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\common\utils.js, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\config\build.json, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\newtab\newtab-hp.html, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\newtab\js\newtab-hp.js, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\settings\common\redirect.js, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\settings\partner\background.js, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\settings\partner\Reporting.js, Quarantined, [5822fac63a504cea4e03579ff70cdb25],
PUP.Optional.ILivid.A, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf\1.1_0\_metadata\verified_contents.json, Quarantined, [5822fac63a504cea4e03579ff70cdb25],

Physical Sectors: 0
(No malicious items detected)

(end)

**Cassel** · June 30th, 2015, 07:48 AM

ADWcleaner log:

# AdwCleaner v3.010 - Report created 30/06/2015 at 07:19:10
# Updated 20/10/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : User - CAROLEDESKTOP
# Running from : E:\Carole\Utilitaires\adwcleaner.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17840

-\\ Mozilla Firefox v38.0.1 (x86 en-US)

[ File : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\6o1l1ku7.default\prefs.js ]

-\\ Google Chrome v43.0.2357.130

[ File : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [2550 octets] - [27/10/2014 21:42:40]
AdwCleaner[R1].txt - [2849 octets] - [28/06/2015 09:02:46]
AdwCleaner[R2].txt - [2908 octets] - [28/06/2015 11:24:57]
AdwCleaner[R3].txt - [1204 octets] - [30/06/2015 07:08:53]
AdwCleaner[S0].txt - [2634 octets] - [27/10/2014 21:47:50]
AdwCleaner[S1].txt - [3005 octets] - [28/06/2015 11:32:23]
AdwCleaner[S2].txt - [1126 octets] - [30/06/2015 07:19:10]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1186 octets] ##########

**Cassel** · June 30th, 2015, 07:56 AM

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.2.3 (06.30.2015:1)
OS: Windows 7 Home Premium x64
Ran by User on 30/06/2015 at 8:52:26.47
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Tasks

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

~~~ Chrome

Successfully deleted: [Folder] C:\Users\User\appdata\local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic

[C:\Users\User\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\User\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:
gpdjojdkbbmdfjfahjcgigfpmkopogic
majjphhgppkndjjkmhhnbgafooenebhd
nafaimnnclfjfedmmabolbppcngeolgf

[C:\Users\User\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\User\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[
aaipilfmheplbcghignccoiiebekkdhe,
gpdjojdkbbmdfjfahjcgigfpmkopogic,
majjphhgppkndjjkmhhnbgafooenebhd,
nafaimnnclfjfedmmabolbppcngeolgf
]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 30/06/2015 at 8:55:22.81
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Thread: [RESOLVED] I thought it was my site, but it might be my computer

Thread Tools

Search Thread

Display

[RESOLVED] I thought it was my site, but it might be my computer

Thread Information

Users Browsing this Thread

Posting Permissions